# arXiv cs.AI paper proposes ADLER to limit private-data leaks in cloud-assisted answers [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-paper-proposes-adler-to-limit-private-data-leaks-in-4da509f1) The paper’s authors argue that a web assistant can leak private document content through messages exchanged with a cloud model, even when that content appears in neither the approved public view nor the final answer. In their planted-secret audit, speculative decoding sent a secret code to the cloud in rejected drafts, although the answers did not include it. They present ADLER, a protocol for streaming LLM APIs that makes every cloud-bound message depend only on the approved public view and the answer shown to the user. A client-side leakage ledger tracks disclosure in the answer against a public reference process. The authors report that, in their audit, no ADLER configuration exposed the secret beyond the answer. On GSM8K math problems with numerical values masked in the cloud’s input, the authors report that ADLER with an unlimited leakage budget raised exact-match accuracy under lenient answer parsing. For a 0.5B client, accuracy rose from 0.41 to 0.83; for a 1.5B client, it rose from 0.67 to 0.85. Budgets of 16 nats or less left accuracy near the cloud-only baseline. The results illustrate the paper’s central trade-off: allowing more disclosure in answers can improve performance, while the ledger records that disclosure. The abstract does not establish how the protocol performs outside these audits and benchmark conditions. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T07:02:14.575Z. First observed: 2026-10-30T06:45:29.188Z. Retrieved: 2026-10-31T06:17:14.156Z. - [Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger](https://arxiv.org/abs/2610.38126) ## Limits The evidence is the paper abstract, not its full methods or results; it does not establish performance beyond the described audit and GSM8K conditions. The abstract does not specify how the reported results generalize to other private-document tasks or deployment settings. ## Open question How does ADLER perform on private-document tasks beyond the reported planted-secret audit and GSM8K conditions? ## Source-stated The authors say collaborative decoding messages can disclose private content absent from both the approved public view and the final answer. > the message transcript can disclose private content that neither the public view nor the answer contains - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated In a planted-secret audit, speculative decoding sent a secret code in rejected drafts, though it was absent from the answers. > did not include the secret code in its answers, yet sent the code to the cloud in rejected drafts - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated ADLER is designed so every message to the cloud depends only on the public view and the user-visible answer. > every message to the cloud depends only on the public view and the answer the user sees - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated On GSM8K with numerical values masked from the cloud, ADLER with an unlimited leakage budget raised reported exact-match accuracy for both tested client sizes under lenient answer parsing. > raises the exact-match accuracy of a 0.5B client from 0.41 to 0.83 and of a 1.5B client from 0.67 to 0.85 under lenient answer parsing - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated The authors report that budgets of 16 nats or less left GSM8K accuracy near the cloud-only baseline. > budgets of 16 nats or less leave accuracy near the cloud-only baseline on GSM8K - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source and contributor context Yuan, Liang, Du, Xiaohu, Luo, Ruikun, Wang, Jinze, Rana, Mashud, Wang, Kaibin, Zhou, Jiangwen, Li, Bo, Xia, Xiaoyu · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: b867d750-9b74-4cac-8eca-ab10e1ee03ab. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T07:02:14.575Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 1030277fd8396a9b0eee28d5beeeaceb12099dba3f574be8076d4d09c91767a9. Source text hash: 2747f69b34e90af0d516dec2c494b2f961028d37cd0fbe7386f33e99165dee52. ## Revision and source-check history ### Version 1 — 2026-11-13T07:02:14.575Z The paper’s authors argue that a web assistant can leak private document content through messages exchanged with a cloud model, even when that content appears in neither the approved public view nor the final answer. In their planted-secret audit, speculative decoding sent a secret code to the cloud in rejected drafts, although the answers did not include it. They present ADLER, a protocol for streaming LLM APIs that makes every cloud-bound message depend only on the approved public view and the answer shown to the user. A client-side leakage ledger tracks disclosure in the answer against a public reference process. The authors report that, in their audit, no ADLER configuration exposed the secret beyond the answer. On GSM8K math problems with numerical values masked in the cloud’s input, the authors report that ADLER with an unlimited leakage budget raised exact-match accuracy under lenient answer parsing. For a 0.5B client, accuracy rose from 0.41 to 0.83; for a 1.5B client, it rose from 0.67 to 0.85. Budgets of 16 nats or less left accuracy near the cloud-only baseline. The results illustrate the paper’s central trade-off: allowing more disclosure in answers can improve performance, while the ledger records that disclosure. The abstract does not establish how the protocol performs outside these audits and benchmark conditions. ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T07:02:14.575Z. First observed: 2026-10-30T06:45:29.188Z. Retrieved: 2026-10-31T06:17:14.156Z. - [Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger](https://arxiv.org/abs/2610.38126) ## Limits The evidence is the paper abstract, not its full methods or results; it does not establish performance beyond the described audit and GSM8K conditions. The abstract does not specify how the reported results generalize to other private-document tasks or deployment settings. ## Open question How does ADLER perform on private-document tasks beyond the reported planted-secret audit and GSM8K conditions? ## Source-stated The authors say collaborative decoding messages can disclose private content absent from both the approved public view and the final answer. > the message transcript can disclose private content that neither the public view nor the answer contains - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated In a planted-secret audit, speculative decoding sent a secret code in rejected drafts, though it was absent from the answers. > did not include the secret code in its answers, yet sent the code to the cloud in rejected drafts - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated ADLER is designed so every message to the cloud depends only on the public view and the user-visible answer. > every message to the cloud depends only on the public view and the answer the user sees - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated On GSM8K with numerical values masked from the cloud, ADLER with an unlimited leakage budget raised reported exact-match accuracy for both tested client sizes under lenient answer parsing. > raises the exact-match accuracy of a 0.5B client from 0.41 to 0.83 and of a 1.5B client from 0.67 to 0.85 under lenient answer parsing - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source-stated The authors report that budgets of 16 nats or less left GSM8K accuracy near the cloud-only baseline. > budgets of 16 nats or less leave accuracy near the cloud-only baseline on GSM8K - [Supporting source](https://arxiv.org/abs/2610.38126) ## Source and contributor context Yuan, Liang, Du, Xiaohu, Luo, Ruikun, Wang, Jinze, Rana, Mashud, Wang, Kaibin, Zhou, Jiangwen, Li, Bo, Xia, Xiaoyu · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: b867d750-9b74-4cac-8eca-ab10e1ee03ab. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T07:02:14.575Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 1030277fd8396a9b0eee28d5beeeaceb12099dba3f574be8076d4d09c91767a9. Source text hash: 2747f69b34e90af0d516dec2c494b2f961028d37cd0fbe7386f33e99165dee52. ### uncertain — 2026-11-13T07:02:14.575Z — anthropic/claude-opus-5.5 Publication: b867d750-9b74-4cac-8eca-ab10e1ee03ab attribution — pass: The findings are attributed to the paper's authors, which matches the arXiv abstract. The title's 'arXiv cs.AI' label follows the publisher metadata. The paper's primary category is cs.CR with a cs.AI cross-list, but this does not misattribute the work. > Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) summary — uncertain: Missing context: the draft never says the setup pairs a small on-device model with a cloud LLM, so readers cannot see why messages are exchanged or what a 'client' is. Smallest repair: add that clause. 'Nats' and 'cloud-only baseline' are unexplained (suggest term-library entries). The draft also omits the 0.92 full-upload result and the 0.69 zero-leakage program baseline, which frame ADLER's gain. 'Tracks' softens 'bounds'. It also drops the 'regardless of how... the cloud behaves' condition. > pairing a small on-device model with a cloud LLM behind a Web API date — pass: The originalPublished date of 2026-10-28 matches the v1 submission date in the arXiv submission history. > \[Submitted on 28 Oct 2026\] support — pass: Each claim's excerpt matches the abstract. The trade-off sentence is grounded in the ledger recording the disclosure charge for the gain. The limitations and the question do not overstate the evidence or turn benchmark scores into real-world reliability. > The ledger records the disclosure charge associated with this gain media — pass: The selected media is the verified direct link to the original arXiv abstract page, which is the most relevant access point. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/4da509f139921db49256ae1bcea92adc4b85eceb9d65f138ad2e0479fd96f99a/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-paper-proposes-adler-to-limit-private-data-leaks-in-4da509f1.json)